FreeBSD Denial of Service Vulnerability (CNVD-2020-68860)

FreeBSD is a Unix-like operating system from the Freebsd Foundation. pts is a pseudo-terminal driver used in it. FreeBSD suffers from a denial of service vulnerability, which can be exploited by an attacker to force the use of a freed memory area via FreeBSD's ICMPv6 to trigger a denial of servic...

FreeBSD : FreeBSD -- Multiple vulnerabilities in rtsold (e2748c9d-3483-11eb-b87a-901b0ef719ab)

Two bugs exist in rtsold8's RDNSS and DNSSL option handling. First, rtsold8 failed to perform sufficient bounds checking on the extent of the option. In particular, it does not verify that the option does not extend past the end of the received packet before processing its contents. The kernel...

FreeBSD : FreeBSD -- ICMPv6 use-after-free in error message handling (8eed0c5c-3482-11eb-b87a-901b0ef719ab)

When an ICMPv6 error message is received, the FreeBSD ICMPv6 stack may extract information from the message to hand to upper-layer protocols. As a part of this operation, it may parse IPv6 header options from a packet embedded in the ICMPv6 message. The handler for a routing option caches a point...

Freebsd FreeBSD Security Vulnerability

FreeBSD is a Unix-like operating system from the Freebsd Foundation. pts is a pseudo-terminal driver used in it. FreeBSD has a security vulnerability that can be exploited by an attacker to run code using the FreeBSD rtsold vulnerability...

FreeBSD 资源管理错误漏洞

FreeBSD is a Unix-like operating system from the Freebsd Foundation. pts is a pseudo-terminal driver used in it. FreeBSD suffers from a denial of service vulnerability, which can be exploited by an attacker to force the use of a freed memory area via FreeBSD's ICMPv6 to trigger a denial of servic...

FreeBSD : xorg-server -- Multiple input validation failures in X server XKB extension (76c8b690-340b-11eb-a2b7-54e1ad3d6335)

The X.org project reports : These issues can lead to privileges elevations for authorized clients on systems where the X server is running privileged. Insufficient checks on the lengths of the XkbSetMap request can lead to out of bounds memory accesses in the X server. Insufficient checks on inpu...

PlayStation: SMAP bypass

SMAP is a security feature on x86 CPUs, that forbids ring0 from reading/writing to ring3 pages, making it harder to exploit entire classes of vulnerabilities. There is a vulnerability in FreeBSD 12 that allows SMAP to be bypassed by userland. There is a very high probability that it affects the P...

FreeBSD-SA-20:32.rtsold

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-20:32.rtsold Security Advisory The FreeBSD Project Topic: Multiple vulnerabilities in rtsold Category: core Module: rtsold Announced: 2020-12-01 Credits:...

FreeBSD -- ICMPv6 use-after-free in error message handling

Problem Description: When an ICMPv6 error message is received, the FreeBSD ICMPv6 stack may extract information from the message to hand to upper-layer protocols. As a part of this operation, it may parse IPv6 header options from a packet embedded in the ICMPv6 message. The handler for a routing...

FreeBSD -- Multiple vulnerabilities in rtsold

Problem Description: Two bugs exist in rtsold8's RDNSS and DNSSL option handling. First, rtsold8 failed to perform sufficient bounds checking on the extent of the option. In particular, it does not verify that the option does not extend past the end of the received packet before processing its...

FreeBSD-SA-20:31.icmp6

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-20:31.icmp6 Security Advisory The FreeBSD Project Topic: ICMPv6 use-after-free in error message handling Category: core Module: icmp6 Announced: 2020-12-01...

FreeBSD : nomad -- multiple vulnerabilities (618010ff-3044-11eb-8112-000c292ee6b8)

The HashiCorp team reports : - artifact: Fixed a bug where interpolation can be used in the artifact destination field to write artifact payloads outside the allocation directory. - template: Fixed a bug where interpolation can be used in the template source and destination fields to read or writ...

FreeBSD : gitea -- multiple vulnerabilities (55facdb0-2c24-11eb-9aac-08002734b9ed)

The Gitea Team reports for release 1.12.6 : - Prevent git operations for inactive users - Disallow urlencoded new lines in git protocol paths if there is a port C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database :...

FreeBSD : mutt -- authentication credentials being sent over an unencrypted connection (dc132c91-2b71-11eb-8cfd-4437e6ad11c4)

Kevin J. McCarthy reports : Mutt had incorrect error handling when initially connecting to an IMAP server, which could result in an attempt to authenticate without enabling TLS. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD...

FreeBSD : Node.js -- November 2020 Security Releases (ad792169-2aa4-11eb-ab71-0022489ad614)

Node.js reports : Updates are now available for v12.x, v14.x and v15.x Node.js release lines for the following issues. Denial of Service through DNS request CVE-2020-8277 A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of...

FreeBSD : libjpeg-turbo -- Issue in the PPM reader causing a buffer overrun in cjpeg, TJBench, or the tjLoadImage() function. (23a667c7-0b28-11eb-8834-00155d01f202)

libjpeg-turbo releases reports : This release fixes the following security issue : - Heap-based buffer over-read in getrgbrow in rdppm.c via a malformed PPM input file. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML...

FreeBSD : mozjpeg -- heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file (040707f9-0b2a-11eb-8834-00155d01f202)

NIST reports : - Heap-based buffer over-read in getrgbrow in rdppm.c via a malformed PPM input file. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2020 Jacques Vidrine and contributors...

FreeBSD : mantis -- multiple vulnerabilities (19259833-26b1-11eb-a239-1c697a013f4b)

Mantis 2.24.3 release reports : This release fixes 3 security issues : - 0027039: CVE-2020-25781: Access to private bug note attachments - 0027275: CVE-2020-25288: HTML Injection on bugupdatepage.php - 0027304: CVE-2020-25830: HTML Injection in bugactiongrouppage.php C Tenable Network Security,...

SAD DNS — New Flaws Re-Enable DNS Cache Poisoning Attacks

A group of academics from the University of California and Tsinghua University has uncovered a series of critical security flaws that could lead to a revival of DNS cache poisoning attacks. Dubbed "SAD DNS attack" short for Side-channel AttackeD DNS, the technique makes it possible for a maliciou...

FreeBSD : go -- math/big: panic during recursive division of very large numbers; cmd/go: arbitrary code execution at build time through cgo (db4b2f27-252a-11eb-865c-00155d646400)

The Go project reports : A number of math/big.Int methods Div, Exp, DivMod, Quo, Rem, QuoRem, Mod, ModInverse, ModSqrt, Jacobi, and GCD can panic when provided crafted large inputs. For the panic to happen, the divisor or modulo argument must be larger than 3168 bits on 32-bit architectures or 63...